Veille CVE

Recherche « Sap commerce cloud »

4 CVE

Critique 3 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Sap commerce cloud » ✕
  1. CVE-2026-89113 8.8 Élevée

    SAP_SE SAP Commerce Cloud (OOTB Code)

    SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application.

  2. CVE-2026-58231 10.0 Critique

    SAP_SE SAP Commerce Cloud (Data Hub Adapter)

    SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.

  3. CVE-2026-44761 9.1 Critique

    SAP_SE SAP Commerce Cloud

    SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability.

  4. CVE-2019-0344 9.8 Critique Exploitée

    SAP SE SAP Commerce Cloud (virtualjdbc extension) · sap commerce_cloud · Sap commerce cloud

    Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.